How to include both Azure group ID and group Name in the SAML response

Question

Our Azure Enterprise application requires us to send both the ID and Name of Azure cloud groups in the same SAML response for SSO. However, we've tried multiple options, and it seems we can only send either the group ID or group name. Is there any solution to this? Thanks.

Answer 1

Hi @Sivaprasad SS , unfortunately you're correct that this can't be done at the moment. "Unfortunately, at the moment, Microsoft Entra ID can't provide a claim with multiple values. Which means you can only send one piece of information for each claim, and you're not able to use an array as a value."

As mentioned in that thread however, you can use the "Azure AD App Roles" feature. This enables you to add specific roles to your application. Afterwards, you can assign these roles to individual users or groups. If a user is a member of multiple groups, each with different roles assigned, Azure AD can include all these roles in the claims. This makes it possible to have multiple values for this attribute. For more details, please refer the article https://learn.microsoft.com/en-us/entra/identity-platform/enterprise-app-role-management

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James